General
-
Target
2d6d77d56d45d751d13bf0483a21cf6d
-
Size
1.0MB
-
Sample
211005-xfsedaacb6
-
MD5
2d6d77d56d45d751d13bf0483a21cf6d
-
SHA1
6353a9f6b1e32913a1cafd0b53d95006e693a991
-
SHA256
c676489a5be0d3bd669d9593af8cca317cd10ffd478a6ad63dbb5a18c6c10454
-
SHA512
7b3b7ae3a29f13b4073f10acde94babed361f98dfe9453700649bdbb7aa89bcef9f0f23b8a10f043f37ae0ebfd04a0a0e3b21dde4c4977df977a755eab8ab4ad
Static task
static1
Behavioral task
behavioral1
Sample
2d6d77d56d45d751d13bf0483a21cf6d.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
2d6d77d56d45d751d13bf0483a21cf6d.exe
Resource
win10v20210408
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Extracted
raccoon
1.8.1
e16d9c3413a8d3bc552d87560e5a14148908608d
-
url4cnc
https://t.me/brikitiki
Extracted
oski
milsom.ug
Targets
-
-
Target
2d6d77d56d45d751d13bf0483a21cf6d
-
Size
1.0MB
-
MD5
2d6d77d56d45d751d13bf0483a21cf6d
-
SHA1
6353a9f6b1e32913a1cafd0b53d95006e693a991
-
SHA256
c676489a5be0d3bd669d9593af8cca317cd10ffd478a6ad63dbb5a18c6c10454
-
SHA512
7b3b7ae3a29f13b4073f10acde94babed361f98dfe9453700649bdbb7aa89bcef9f0f23b8a10f043f37ae0ebfd04a0a0e3b21dde4c4977df977a755eab8ab4ad
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-